Bound and configure the per-Domain runsc dcache

crates/lazaret-core/tests/configuration.rs

@@ -13,8 +13,8 @@ use lazaret_core::configuration::{
 };
 use lazaret_core::identity::HostPath;
 use lazaret_core::records::{
-    ConfigurationFingerprintRecordV1, EnvironmentReference, ResolvedAutoApprovalRule,
-    ResolvedVolume, VolumeAccess, VolumeKind,
+    ConfigurationFingerprintRecordV1, DEFAULT_RUNSC_DCACHE, EnvironmentReference, MAX_RUNSC_DCACHE,
+    ResolvedAutoApprovalRule, ResolvedVolume, VolumeAccess, VolumeKind,
 };
 use static_assertions::assert_not_impl_any;
 
@@ -150,6 +150,7 @@ image = "example.invalid/agent:v1"
     assert!(parsed.storage().data_root.is_none());
     assert!(parsed.network().default_allow.is_empty());
     assert!(parsed.network().default_deny.is_empty());
+    assert_eq!(parsed.runtime().runsc_dcache, DEFAULT_RUNSC_DCACHE);
 
     for (value, expected) in [
         ("[]", Vec::<String>::new()),
@@ -212,6 +213,47 @@ volumes = [{ host = "/source", container = "/root/source", kind = "socket" }]
     }
 }
 
+#[test]
+fn runtime_dcache_defaults_accepts_budget_bounds_and_rejects_excess() {
+    let minimal = r#"schema = "lazaret-trusted-host-config-v1"
+[profiles.default]
+image = "example.invalid/agent:v1"
+"#;
+    assert_eq!(
+        parse_trusted_configuration(minimal.as_bytes())
+            .unwrap()
+            .runtime()
+            .runsc_dcache,
+        DEFAULT_RUNSC_DCACHE
+    );
+    for value in [0, MAX_RUNSC_DCACHE] {
+        let explicit = minimal.replace(
+            "[profiles.default]",
+            &format!("[runtime]\nrunsc_dcache = {value}\n[profiles.default]"),
+        );
+        assert_eq!(
+            parse_trusted_configuration(explicit.as_bytes())
+                .unwrap()
+                .runtime()
+                .runsc_dcache,
+            value
+        );
+    }
+    let excessive = minimal.replace(
+        "[profiles.default]",
+        &format!(
+            "[runtime]\nrunsc_dcache = {}\n[profiles.default]",
+            MAX_RUNSC_DCACHE + 1
+        ),
+    );
+    assert_eq!(
+        parse_trusted_configuration(excessive.as_bytes())
+            .unwrap_err()
+            .kind(),
+        ConfigurationErrorKind::InvalidRuntime
+    );
+}
+
 #[test]
 fn sandbox_layout_is_closed_normalized_and_requires_workspace() {
     assert!(SandboxLayoutV1::from_protected_destinations(["/proc".into()]).is_err());
@@ -834,6 +876,7 @@ fn digest_vectors_are_framed_and_order_independent() {
         selected_profile: "default".into(),
         storage_root: HostPath::new(b"/data".to_vec()),
         runtime_root: HostPath::new(b"/run/user/1000/lazaret".to_vec()),
+        runsc_dcache: DEFAULT_RUNSC_DCACHE,
         image: "example.invalid/agent:v1".into(),
         isolate_gitignored: true,
         persistent_dirs: vec!["/var".into(), "/root".into()],
@@ -867,9 +910,9 @@ fn digest_vectors_are_framed_and_order_independent() {
     assert_eq!(
         first.as_bytes(),
         &[
-            0xd3, 0xba, 0xef, 0x91, 0x21, 0x0f, 0x98, 0x31, 0x6c, 0xea, 0x34, 0xfb, 0x41, 0xbd,
-            0x6c, 0xa5, 0x07, 0xf0, 0xb8, 0x9b, 0x90, 0x77, 0xaf, 0x0a, 0x0e, 0xd0, 0x6a, 0xd6,
-            0x46, 0xc7, 0x2d, 0xbf,
+            0x5f, 0x1d, 0xeb, 0x46, 0xa4, 0xb5, 0x90, 0xc3, 0x47, 0x0b, 0xa0, 0xdf, 0xd6, 0x6e,
+            0x9d, 0x91, 0xdb, 0xf3, 0x75, 0xf6, 0xbe, 0x50, 0x9a, 0x8d, 0xba, 0x4a, 0x3d, 0xae,
+            0xf3, 0x05, 0x97, 0x56,
         ]
     );
     record.persistent_dirs.reverse();

crates/lazaret-core/tests/schema_records.rs

@@ -195,6 +195,7 @@ struct RawTrustedHostConfigurationV1 {
     schema_id: String,
     storage: StorageConfigurationV1,
     network: NetworkConfigurationV1,
+    runtime: RuntimeConfigurationV1,
     profiles: BTreeMap<String, ProfileConfigurationV1>,
 }
 

crates/lazaret-core/tests/schema_records/documents.rs

@@ -189,6 +189,7 @@ fn trusted_host_configuration_postcard_dispatch_rejects_unknown_schema() {
             schema_id: schema_id.into(),
             storage: StorageConfigurationV1::default(),
             network: NetworkConfigurationV1::default(),
+            runtime: RuntimeConfigurationV1::default(),
             profiles: profiles.clone(),
         };
         assert!(matches!(

crates/lazaret-core/tests/schema_records/encoding.rs

@@ -569,6 +569,7 @@ persistent_dirs = []
             selected_profile: "trusted".into(),
             storage_root: HostPath::new(b"/data/lazaret".to_vec()),
             runtime_root: HostPath::new(b"/run/user/1000/lazaret".to_vec()),
+            runsc_dcache: DEFAULT_RUNSC_DCACHE,
             image: "example.invalid/agent:v1".into(),
             isolate_gitignored: true,
             persistent_dirs: vec!["/root".into()],
@@ -641,8 +642,8 @@ persistent_dirs = []
     assert_eq!(
         seen.digest(),
         [
-            245, 169, 157, 164, 67, 211, 165, 23, 129, 62, 119, 92, 247, 248, 131, 4, 252, 42, 34,
-            214, 207, 60, 126, 219, 81, 68, 159, 6, 26, 88, 233, 108,
+            23, 80, 80, 177, 148, 141, 234, 213, 240, 108, 167, 148, 252, 121, 212, 128, 5, 195,
+            176, 126, 71, 76, 141, 196, 174, 125, 212, 31, 115, 155, 178, 139,
         ]
     );
 }